ai-workspace-infra/iac_modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #69 from svc-design/vpn-overlay-xray

Browse Source 
feat(xray-site): add vpn-xray-client playbook and update site config …
This commit is contained in:
shenlan 2025-04-22 13:55:39 +08:00 committed by GitHub
commit 4eab3289e3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
8 changed files with 109 additions and 163 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/handlers/main.yml
View File

@ -1,12 +1,6 @@
---
- name: Restart xray service
- name: Restart Xray-client service
systemd:
name: xray.service
state: restarted
enabled: yes
- name: Restart xray-tproxy service
systemd:
name: xray-tproxy.service
name: xray-client.service
state: restarted
enabled: yes

10
ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/tasks/main.yml
View File

@ -31,7 +31,6 @@
creates: /usr/local/bin/xray
notify:
- Restart xray service
- Restart xray-tproxy service
- name: Ensure required directories exist
file:
@ -48,8 +47,7 @@
dest: "{{ item.dest }}"
mode: '0644'
loop:
- { src: "config.json.j2", dest: "{{ xray_config_dir }}/config.json" }
- { src: "tproxy-config.json.j2", dest: "{{ xray_config_dir }}/tproxy-config.json" }
- { src: "client-config.json.j2", dest: "{{ xray_config_dir }}/client-config.json" }
- name: Deploy systemd service templates
template:
@ -57,8 +55,7 @@
dest: "{{ item.dest }}"
mode: '0644'
loop:
- { src: "xray.service.j2", dest: "/etc/systemd/system/xray.service" }
- { src: "xray-tproxy.service.j2", dest: "/etc/systemd/system/xray-tproxy.service" }
- { src: "xray-client.service.j2", dest: "/etc/systemd/system/xray-client.service" }
- name: Reload systemd
systemd:
@ -70,5 +67,4 @@
enabled: yes
state: started
loop:
- xray.service
- xray-tproxy.service
- xray-client.service

94
ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/client-config.json.j2 Normal file
View File

@ -0,0 +1,94 @@
{
"log": {
"loglevel": "debug"
},
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"type": "field",
"domain": [
"geosite:cn",
"geosite:private"
],
"outboundTag": "direct"
},
{
"type": "field",
"ip": [
"geoip:cn",
"geoip:private"
],
"outboundTag": "direct"
}
]
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": 1080,
"protocol": "socks",
"settings": {
"udp": true
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls"
]
}
},
{
"listen": "127.0.0.1",
"port": 1081,
"protocol": "http",
"settings": {},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls"
]
}
}
],
"outbounds": [
{
"protocol": "vless",
"settings": {
"vnext": [
{
"address": "{{ xray_remote_domain }}",
"port": {{ xray_main_port }},
"users": [
{
"id": "{{ xray_uuid }}",
"encryption": "none",
"flow": "xtls-rprx-vision"
}
]
}
]
},
"streamSettings": {
"network": "tcp",
"security": "tls",
"tlsSettings": {
"serverName": "{{ xray_remote_domain }}",
"allowInsecure": false,
"fingerprint": "chrome"
}
},
"tag": "proxy"
},
{
"protocol": "freedom",
"tag": "direct"
},
{
"protocol": "blackhole",
"tag": "block"
}
]
}

70
ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/config.json.j2
View File

@ -1,70 +0,0 @@
{
"log": {
"loglevel": "error"
},
"routing": {
"rules": []
},
"inbounds": [
{
"listen": "0.0.0.0",
"port": {{ xray_main_port }},
"protocol": "vless",
"settings": {
"clients": [
{
"id": "{{ xray_uuid }}",
"flow": "xtls-rprx-vision"
}
],
"decryption": "none",
"fallbacks": [
{
"dest": 8001,
"xver": 1
},
{
"alpn": "h2",
"dest": 8002,
"xver": 1
}
]
},
"streamSettings": {
"network": "tcp",
"security": "tls",
"tlsSettings": {
"minVersion": "1.2",
"rejectUnknownSni": true,
"certificates": [
{
"ocspStapling": 3600,
"certificateFile": "{{ xray_cert_path }}",
"keyFile": "{{ xray_key_path }}"
}
]
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls"
]
}
}
],
"outbounds": [
{
"protocol": "freedom"
}
],
"policy": {
"levels": {
"0": {
"handshake": 2,
"connIdle": 120
}
}
}
}

58
ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/tproxy-config.json.j2
View File

@ -1,58 +0,0 @@
{
"log": {
"loglevel": "info"
},
"routing": {
"rules": []
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": 51830,
"protocol": "dokodemo-door",
"settings": {
"address": "{{ hubs_map[inventory_hostname].xray.relay_address }}",
"port": {{ hubs_map[inventory_hostname].xray.relay_port }},
"network": "udp"
}
}
],
"outbounds": [
{
"protocol": "vless",
"settings": {
"vnext": [
{
"address": "{{ hubs_map[inventory_hostname].xray.relay_address }}",
"port": 1443,
"users": [
{
"id": "{{ hubs_map[inventory_hostname].xray.uuid }}",
"encryption": "none",
"flow": "xtls-rprx-vision"
}
]
}
]
},
"streamSettings": {
"network": "tcp",
"security": "tls",
"tlsSettings": {
"serverName": "{{ hubs_map[inventory_hostname].xray.remote_domain }}",
"allowInsecure": false,
"fingerprint": "chrome"
}
},
"tag": "proxy"
},
{
"protocol": "freedom",
"tag": "direct"
},
{
"protocol": "blackhole",
"tag": "block"
}
]
}

4
ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray-tproxy.service.j2 → ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray-client.service.j2
View File

@ -1,5 +1,5 @@
[Unit]
Description=Xray Tproxy Service
Description=Xray Client Service
Documentation=https://github.com/xtls
After=network.target nss-lookup.target
@ -8,7 +8,7 @@ User=nobody
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/tproxy-config.json
ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/client-config.json
Restart=on-failure
RestartPreventExitStatus=23
LimitNPROC=10000

18
ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray.service.j2
View File

@ -1,18 +0,0 @@
[Unit]
Description=Xray Service
Documentation=https://github.com/xtls
After=network.target nss-lookup.target
[Service]
User=nobody
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/config.json
Restart=on-failure
RestartPreventExitStatus=23
LimitNPROC=10000
LimitNOFILE=1000000
[Install]
WantedBy=multi-user.target

8
ansible/playbooks/vpn-xray-client.yaml Normal file
View File

@ -0,0 +1,8 @@
- name: Setup Xray for hub
hosts: all
become: true
vars:
overlay_config_path: "{{ playbook_dir }}/../../config/sit/vpn-overlay.yaml"
overlay_keys_path: "{{ playbook_dir }}/../../config/sit/vpn-keys.yaml"
roles:
- role: vhosts/vpn-overlay/xray/site